Proceedings [PDF] - Measurement and Analysis of P2P Activity ...

International Conference Advances in the Analysis of Online Paedophile Activity Paris, France; 2-3 June, 2009
– Eclipsing content: we eclipse entries of the DHT to remove the targeted
contents from the network and prevent users from accessing it.
– Index poisoning: we poison the DHT references with very attractive fake
files showing a high number of sources.
– Promoting Honeypots: we attract the final download requests for the
controlled files towards our Honeypots.
By attracting all the publications and searchs of paedophile contents (keywords
and files), our architecture can assess and control the paedophile behavior
from the initial search of keyword to the final download.
3 Experiments
To test our solution, we eclipsed the good references for the keyword ”spiderman”
and poisoned them with 4 fake files for one day. The results in figure 1 and 2
show that our architecture is effective and the importance to control the number
of sources to build an efficient Honeypot. Our upcoming work consists to deploy
our architecture to specifically study and fight against paedophile activities.
Fig. 1. Results of a search for ”spiderman” under eclipse and poison (4 fake files)
Fig. 2. Proportion of download requests received for each fake file
Acknowledgment: This work is funded by the French ANR Research Project
MAPE(Measurement and Analysis of Peer-to-peer Exchanges for pedocriminality
fighting and traffic profiling), under contract ANR-07-TLCOM-24.
90